This repository provides a GitHub Action to run Composer commands within a Docker container. It wraps the Composer CLI, allowing users to specify a command (default `install`), PHP version, Composer version, and various flags like `--no-dev`, `--no-progress`, and `--no-interaction`. The action downloads the appropriate Composer PHAR from getcomposer.org, sets up SSH keys for private repositories if provided, and executes the command inside a Docker container based on the php-actions/php-build image. The workspace is mounted at `/app`. The implementation is a single composite action with a bash script that handles argument parsing, SSH key setup, and Docker execution. It is a straightforward, well-documented action that solves the common problem of running Composer in CI pipelines. No reusable components beyond the action itself exist; the bash script is tightly coupled to GitHub Actions and Docker.
Phuzz is a research-oriented web application fuzzing framework that orchestrates multiple fuzzers (Burp Suite, Wapiti, WFuzz, ZAP) alongside its own custom fuzzer to detect vulnerabilities in web applications. The repository includes a custom Python-based fuzzer with mutation and scoring modules, a crawler for discovering endpoints, a HAR generator for request capture, and Docker-based orchestration for running fuzzers against vulnerable test applications (bWAPP, DVWA, WackoPicko, XVWA, WordPress plugins). It also contains extensive experimental data and analysis scripts from studies on known and zero-day vulnerabilities, particularly targeting WordPress plugins. The architecture is modular, with separate components for crawling, fuzzing, and result analysis, all containerized via Docker Compose. While primarily a research tool, the core fuzzer and instrumentation components are well-structured and could be extracted for reuse in other security testing pipelines.
This is a barebones PHP application designed as a getting-started template for deploying to Heroku. It uses the Slim 4 framework with PHP-DI dependency injection, Twig templating, and Monolog logging. The application has a single route (GET /) that renders a static landing page with links to Heroku documentation. The codebase is minimal and clean, following modern PHP practices, but it is intentionally simple—essentially boilerplate for a 'Hello World' style demo. There is no complex business logic, database interaction, or reusable components beyond the standard Slim application bootstrap pattern. The repository serves as a reference for Heroku's PHP deployment workflow and is not intended for production use.
This repository provides a collection of scripts and lightweight HTTP servers for automated deployment and management of sing-box multi-protocol proxy nodes. It supports VLESS-REALITY, VMess-WebSocket (with optional Cloudflare Argo tunnel), Hysteria2, and TUIC v5 protocols, along with Nezha monitoring agent integration. The primary use case is setting up proxy services on VPS or free hosting platforms like Serv00/CT8, with additional 'toy' implementations for game hosting environments using Go, Node.js, PHP, and Python. The architecture is script-driven: large Bash scripts (sing-box.sh, sb_serv00.sh) handle installation, configuration, and service management via interactive menus or environment variables. They download precompiled binaries, generate sing-box JSON configurations, and manage systemd or OpenRC services. The supplementary HTTP servers (Node.js, Python, PHP) provide subscription endpoints and process lifecycle management, downloading and running a core binary (sbsh) that performs the actual proxy setup. The PHP check.php script offers standalone server environment diagnostics. Code quality is average overall. The Bash scripts are functional but contain significant duplication across Serv00 variants and lack modularity. The Node.js and Python HTTP servers are well-structured and demonstrate clean asynchronous patterns, while the PHP diagnostic script is a polished, self-contained tool. There is no test suite or CI/CD, and external binary URLs are hardcoded, posing medium technical drift risk. The repository is actively maintained by a large community, making it a practical solution for proxy deployment despite its architectural limitations.
This is a PHP library that implements a personal WeChat bot using the web WeChat protocol. It allows users to log in via QR code, monitor incoming messages, and respond automatically through a plugin system. The architecture uses a Laravel-inspired service container with service providers, observers, and a custom extension mechanism. The library provides a CLI entry point and optionally runs as a Swoole-based server for REST API interaction. The code is well-structured but relies on outdated dependencies (Illuminate 5.4, Symfony 3, Guzzle 6.2, PHP 7.0+) and lacks automated tests. The web WeChat protocol is unstable and may be deprecated, limiting production use. The project appears to be maintained minimally, with no recent commits addressing dependency updates or modern PHP practices.
Tieba-Cloud-Sign is a PHP web application designed to automate the sign-in process for Baidu Tieba forums. It provides a web interface for managing multiple Tieba accounts (via BDUSS cookies) and scheduling automatic sign-in tasks through a built-in cron system. The application features a plugin architecture that allows extending functionality, such as pushing sign-in results to QQ via go-cqhttp or backing up the database to QQ. The core system handles user authentication, Tieba API interactions (including retrieving TBS tokens and performing sign-ins), and provides an administrative interface for configuration. Plugins are integrated via hooks and can add their own settings, cron jobs, and UI components. Data is stored in a MySQL database, with tables for users, account credentials, plugin configurations, and operational logs. Key technical components include a custom WebSocket client for real-time communication with go-cqhttp (used by QQ-related plugins), a SQL dump utility for database backups, and an AJAX-driven settings interface. The frontend relies on Bootstrap 3.3.2 and jQuery for responsive UI elements, including modal dialogs for plugin configuration.
Pikachu is a deliberately vulnerable web application built as a training ground for web penetration testing, covering common security flaws such as SQL injection, XSS, CSRF, RCE, file inclusion, unsafe file upload/download, SSRF, XXE, and deserialization. It is a LAMP stack (PHP + MySQL + Apache) monolith using a legacy Ace Admin template and Bootstrap 3. The codebase is organized into vulnerability categories under `/vul/`, a main application for navigation and configuration, and a separate XSS management backend (`/pkxss/`) for collecting stolen cookies, phishing credentials, and keystrokes. The project intentionally uses insecure coding patterns (e.g., raw SQL concatenation, `eval()`, `unserialize()` on user input) to demonstrate exploitation, and includes some secure alternatives for comparison. The repository is explicitly marked as 'asleep' by its authors, who recommend a successor project. It is not suitable for production deployment but serves as a valuable educational resource for security students and CTF players.
This repository is a community-maintained collection of plugins for the Typecho blogging platform, containing over 130 self-contained PHP modules that extend Typecho with features such as comment spam filtering, social media integration, LaTeX rendering, rich text editors (CKEditor, Ueditor, EditorMD), cloud storage uploads (Qiniu, Upyun), caching, backup, SEO, and more. Each plugin follows the standard Typecho plugin interface, hooking into the event system via static methods and factory calls. The codebase is not a single application but an aggregation of independent extensions; many plugins bundle third-party libraries (MathJax 2.7.2, PHPMailer, CodeMirror) directly, leading to significant duplication. Code quality varies widely: a few plugins demonstrate clean abstractions like a notification service strategy pattern or an XSS-safe Markdown wrapper, but the majority are simple procedural or CRUD-based implementations with limited error handling, hardcoded API keys, and deprecated PHP patterns. The repository is updated sporadically by the community, and many plugins target older Typecho versions (0.9, 1.0) with no guarantee of current compatibility.
LanzouAPI is a single-file PHP script that acts as a parsing proxy for Lanzou (蓝奏云) cloud storage share links. It accepts a share URL and optional password, scrapes the Lanzou page, handles anti-scraping challenges (including ESA and acw_sc__v2 cookie generation), and returns a JSON response containing the file name, size, and a direct download URL. Optionally, it can redirect directly to the download. The script includes a local file-based cache with configurable TTL to reduce requests and avoid rate limiting. It also provides a custom suffix replacement feature for download URLs. The codebase is a monolith with no framework, no tests, and no dependency management; all logic resides in a single index.php file. While functional and actively used (as evidenced by the health-check workflow), the architecture is tightly coupled and would require significant refactoring for reuse beyond this specific Lanzou API use case.
TravianZ is a self-hosted multiplayer browser strategy game server, a clone of the popular Travian game. It implements the complete game loop: village building, resource production, troop training, combat, hero system (T4), alliance management with bonuses, market trading, world wonders, and an admin panel for server management. The architecture is a PHP 8.3+/MySQL monolith with procedural entry points and class-based game logic. Key systems include a trait-based database layer (Database.php split into domain-specific traits), a cron-like automation engine (Automation.php split into traits), and a templating system using .tpl files. Features include support for 9 tribes, multi-language (English, French, Italian, Romanian, Chinese), Docker deployment, and an admin panel with CSRF protection and logging. The codebase has undergone significant refactoring from an older codebase, but still retains global state, mixed SQL access patterns (prepared statements alongside raw queries), and legacy JavaScript (MooTools). It is actively maintained with documented bug fixes and performance optimizations.
This is a web application for viewing and analyzing Minecraft server performance timings reports. It consists of a PHP backend that handles report upload, caching, and data transformation, and a React-based frontend for interactive visualization. The backend parses a proprietary compressed timing format from Minecraft servers (Paper, Sponge, etc.) into a structured JSON object, caches it, and serves it via REST endpoints. The frontend fetches this data and renders charts, tables, and drill-down views of timing handlers, regions, and plugins. The application is a single-page application built with React 15, Webpack 2, and Babel 6, with a heavy reliance on jQuery-like PHP utilities and the Stiphle rate-limiting library. The architecture is a classic LAMP stack with PHP serving as both the API and the HTML shell. Key entry points are index.php (main page), data.php (API), post.php (upload endpoint), and backend_daemon.php (CLI daemon). The system uses a file-based cache with gzip compression and serialization. The frontend manages state with a global data object and uses Chart.js for TPS and entity graphs. The codebase demonstrates a custom JSON deserialization trait (FromJson) that maps JSON arrays to typed PHP objects using PHPDoc annotations, which is a notable pattern for handling evolving data formats. However, the project shows significant technical debt with outdated dependencies and a monolithic global state approach in the frontend.
Lsky Pro is a self-hosted image hosting platform written in Laravel (PHP). It allows users to upload, store, manage, and share images through a web interface or REST API. The application supports multiple storage backends (local filesystem, AWS S3, Alibaba OSS, Tencent COS, Qiniu Kodo, Upyun USS, SFTP, FTP, WebDAV, MinIO) and offers features such as user groups with granular permissions, image watermarking, content moderation (via third-party scanning services), thumbnail generation, and a public gallery. The frontend uses Blade templates with Alpine.js and jQuery for interactivity, while the backend follows a standard Laravel MVC pattern with services, models, middleware, and enums for configuration management. The codebase is functional but unremarkable from a software craftsmanship perspective. It follows common Laravel conventions without notable innovation. The storage strategy abstraction, enum use, and middleware for feature toggles are decent patterns, but none are isolated enough to be reusable in other projects without significant modification. The JavaScript is heavily reliant on global state and inline jQuery, which reduces testability and maintainability. The project has minimal test coverage (only example tests) and the README explicitly states that the open source version has ceased maintenance. Maintenance is effectively abandoned; the last commit is dated in the future (presumably a metadata error) but the project is marked as no longer supported. Dependencies may be outdated, and the reliance on external cloud SDKs introduces potential compatibility risks. Technical drift is moderate: the application uses Laravel 9 and Tailwind CSS, which are still reasonably current, but the JavaScript dependencies are older and the overall architecture is monolithic. The lack of active development and the explicit deprecation warning make this repository unsuitable for new projects seeking ongoing support, though it could serve as a reference for building a similar image hosting platform.
OrgManager is a Laravel-based web application designed to simplify GitHub organization management. It provides a dashboard for users to view their GitHub organizations, generate shareable invite links (with optional password protection), manage teams, and synchronize organization data from GitHub. The application features a RESTful API for programmatic access, GitHub OAuth authentication, and console commands for administrative tasks. Built with Laravel 5.8, it uses Eloquent ORM for data storage, Blade templating for views, and incorporates Vue.js for interactive components. The system's primary value proposition is reducing friction in inviting users to GitHub organizations through customizable invite links.
CloudTranscode is a distributed media transcoding system that uses AWS Step Functions for orchestration and PHP-based workers to process media files. Workers download input from S3 or HTTP, execute FFmpeg or ImageMagick commands for transcoding (video, image, thumbnails, etc.), and upload results to S3. The architecture features stateless workers running in ECS containers, with AWS Step Functions managing task distribution and retries. A key characteristic is sequential processing: each TranscodeAssetActivity worker handles all outputs in a job one after another, creating a performance bottleneck for multi-output jobs. The system relies on AWS SDK for PHP, JSON Schema validation, and a custom fork of CloudProcessingEngine-SDK for activity lifecycle management. Deployment is via Docker images built from the provided Dockerfile, which bundles PHP 8.2, FFmpeg 4.2, and ImageMagick.
This repository is a PHP-based living style guide boilerplate that generates a web-based style guide from HTML markup snippets and Markdown documentation. The system scans directories of markup files, renders them with syntax highlighting (Prism.js), and provides a navigable interface with color swatches, font stacks, and documentation sections. It is a simple, monolithic PHP application with a single entry point (index.php) and a helper functions file (functions.php). While the code is clean and well-commented, it relies on outdated practices (no dependency management, no modern PHP, legacy CSS vendor prefixes) and has not been updated since 2018. The repository serves as a starting point for teams to create custom style guides, but it requires significant modernization to be used effectively in contemporary front-end workflows.
This repository is a PHP-based monolithic web application called '引流宝' (Traffic Treasure), designed for private-domain traffic acquisition and marketing within the Chinese WeChat ecosystem. It provides a suite of tools including dynamic QR code management for WeChat groups (活码), customer service codes, channel codes, short URLs, Taobao affiliate intermediate pages, share cards (WeChat sharing), coupon key distribution, and a plugin system for extensions like WeChat external link bridging and anti-blocking. The backend is implemented in raw PHP without frameworks, using a custom PDO wrapper for MySQL. The frontend uses jQuery and Bootstrap. The application is feature-complete and actively used (2005 stars), but the codebase suffers from severe code duplication, weak security practices (MD5 hashing, SQL injection points, hardcoded secrets), outdated vendored libraries (PHPMailer, Chart.js, TailwindCSS, jsQR), and no automated testing. It represents a functional but poorly engineered tool that would require significant refactoring for production safety or reuse outside its specific marketing domain.
This repository is a community-driven collection of programming exercise solutions, organized as a numbered roadmap (00 to 50) covering fundamental to intermediate topics. Each exercise is solved in multiple programming languages (Python, JavaScript, Java, C++, Go, Kotlin, etc.) by different contributors. The code consists of standalone scripts that demonstrate language features such as recursion, data structures, exception handling, async programming, regular expressions, design patterns (Singleton, Decorator), and SOLID principles. The repository is not a cohesive application or library; it is an educational resource for learning and practicing programming concepts across languages. The quality of solutions varies widely, with some files containing errors or being incomplete. The project relies on community contributions and lacks centralized testing or dependency management.
This repository is a simple Content Management System (CMS) built on the CodeIgniter 3.x PHP framework. It provides basic CRUD operations for news articles organized by channels, user authentication (login/registration), and file uploads via the deprecated Uploadify library. The system includes a REST API for news and authentication, and integrates CKEditor for rich text editing. However, the codebase is severely outdated, relying on deprecated PHP extensions (mysql_, mcrypt), an unmaintained framework version, and obsolete frontend libraries. There are no tests, no modern security practices, and the architecture is a straightforward monolithic MVC with tightly coupled components. It offers limited reuse potential and should be considered a legacy application requiring significant modernization.
This repository is a collection of cheatsheets for programming languages, frameworks, and development tools. It is not a software application, data pipeline, or research project. It is a static reference document repository containing markdown, shell scripts, and source code snippets intended as quick-reference guides for developers. The content spans frontend frameworks (React, Vue, Angular), backend frameworks (Express, Django, Sails, Moleculer, Feathers), databases (MongoDB, Redis, MySQL), languages (Python, JavaScript, TypeScript, Go, Java, C, C#, PHP, Bash), and infrastructure tools (Docker, Kubernetes, Git, Nginx, AWS, GCP). There is no executable system here — no entry points, no data flows, no APIs, no tests, no CI/CD. It is purely informational content. The repository has 46K+ stars and 6.7K forks, indicating high community value as a reference resource. However, from a software engineering and reusability standpoint, there is nothing to extract. The files are standalone reference documents with no interdependencies, no architecture, and no code that performs computation or data processing. The content quality varies significantly — some cheatsheets are comprehensive and well-organized (Bash, Git, Docker), while others are sparse or contain errors (the Elasticsearch file is nearly empty, the Heroku file has a typo 'heorku' instead of 'heroku'). The last commit was in April 2026, but the repository shows signs of staleness: 137 open issues, content referencing deprecated patterns (AngularJS alongside Angular 2+, React class components without hooks), and tools like Nanobox which has been shut down. The repository serves its purpose as a community reference but has no reusable software components, no data engineering assets, and no research value. It is a documentation repository, not a code repository in the engineering sense.
This repository contains a collection of example SQLMap command lines for bypassing Web Application Firewalls (WAF) during SQL injection penetration testing. It is essentially a cheat sheet or reference guide, not a software application. The content is provided in plain text files with various tamper script combinations and techniques. The repository has no actual code, scripts, or executable components; it solely consists of documentation and example usage. While the commands may be useful for security professionals, the repository itself is not a functional tool and has seen no active development since its creation around 2021.